There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence
    of memory corruption and we presume that with enough effort some of these could have been exploited to run
    arbitrary code. This vulnerability affects Firefox < 83. (CVE-2020-26969)

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote
    attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and
    a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox <
    83. (CVE-2020-26952)

  - It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus
    making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects
    Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26953)

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory.

  - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs     present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-26969)

  - In Freetype, if PNG images were embedded into fonts, the <code>LoadSBitPng</code> function contained an     integer overflow that led to a heap buffer overflow, memory corruption, and an exploitable crash. Note:
    While Project Zero did discover instances of this vulnerability being exploited in the wild against     Chrome, in Firefox this vulnerability is only triggerable if a rarely-used, hidden preference is toggled,     and only affected Linux and Android operating systems. Other operating systems are unaffected; and Linux     and Android are unaffected in the default configuration. (CVE-2020-15999)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. (CVE-2020-26951)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and     a potentially exploitable crash when handling out-of-memory errors. (CVE-2020-26952)

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     <code>drawImage</code> function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks. (CVE-2020-16012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to     Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the     browser to read and interact with web content. The feature was implemented as a unix domain socket,     protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This     was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only     affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox     < 83. (CVE-2020-26964)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Firefox installed on the remote Windows host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory.

  - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs     present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-26969)

  - In Freetype, if PNG images were embedded into fonts, the <code>LoadSBitPng</code> function contained an     integer overflow that led to a heap buffer overflow, memory corruption, and an exploitable crash. Note:
    While Project Zero did discover instances of this vulnerability being exploited in the wild against     Chrome, in Firefox this vulnerability is only triggerable if a rarely-used, hidden preference is toggled,     and only affected Linux and Android operating systems. Other operating systems are unaffected; and Linux     and Android are unaffected in the default configuration. (CVE-2020-15999)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. (CVE-2020-26951)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and     a potentially exploitable crash when handling out-of-memory errors. (CVE-2020-26952)

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     <code>drawImage</code> function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks. (CVE-2020-16012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
404375	Alpine: multiple firefox packages: security update to 83.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/20/2026	critical
404375	Alpine: multiple firefox packages: security update to 83.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/20/2026	critical
426894	Alpine: multiple librewolf packages: security update to 83.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	7/20/2026	critical
426894	Alpine: multiple librewolf packages: security update to 83.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	7/20/2026	critical
142911	Mozilla Firefox < 83.0	Nessus	MacOS X Local Security Checks	11/17/2020	11/18/2025	critical
245330	Linux Distros Unpatched Vulnerability : CVE-2020-26964	Nessus	Misc.	8/7/2025	7/28/2026	medium
142910	Mozilla Firefox < 83.0	Nessus	Windows	11/17/2020	11/18/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

medium

critical